(ii) creating a second signe ture comprising a plurality of parameters related to the associated 
telephone calls over a second period shorter than the first and more recent that the first; 

(iii) updating the first sign iture by a weighted averaging with the second signature; 

(iv) inputting the signatures to the anomaly detector; and 

(v) processing the signatures using the anomaly detector to derive the potentially fi-audulent 
telephone calls by detec ting unexpected patterns in the telephone calls associated with the 
entity over the time period. 

24. A method as claimed in claim 23 wherein the first signature is created in one of a plurality of 
predetermined possible formats. 

25 . A method as claimed in claim 24 wherein th^format of the first signature comprises the length 
of the signature. 



26. A method as claimed in clai 
to the transmission of 
position of the portio 




ein at least one parameter of the first signature is related 
over a portion of the period and also related to the 
iod. 



27. A method as claimed in claim 26 wherein said at least one parameter represents the number 
of events made in theyportion of the first time period as a proportion of the total number 
of events made in the whole first time period. 



28. A method as claimed in claim 26 
of events of a predetermine^ 
proportion of the total nu 
period. 




rein said at least one parameter represents the number 
ade in the portion of the first time period as a 
f events of the same type made in the whole first time 




(i) 



(ii) 



(iii) 
(iv) 



entity; 
a processor arranged to 
related to the telephone 
second signature compri: 
a second period shorter 



29. A computer system for detecting potentially fraudulent telephone calls from telephone calls 
associated with an entity ^ over time, the system comprising: 

an input arranged to rec 2ive information about the telephone calls associated with the 



create a first signature comprising a plurality of parameters 
calls over a predetermined first time period and to create a 
ing a plurality of parameters related to the telephone calls over 
1 han the first and more recent than the first; and wherein the 



processor is arranged to c ilculate a weighted averaging of the first and second signatures 
to form an updated first Signature; 
an anomaly detector; 

an input arranged to provide the signatures to the anomaly detector; and wherein said 
anomaly detector is arranged to process the signatures to derive the potentially 
fraudulent telephone calls by detecting unexpected patterns in the telephone calls 
associated with the entity over the predetermined time period. 



